The Blaze Demo Importer plugin for WordPress contains a function called blaze_demo_importer_install_plugin that performs no capability check. As a result, any authenticated user with Subscriber level or higher can invoke the function to install and activate a small, predefined set of plugins. The plugin specifically allows the installation of the News Kit Elementor Addons plugin and a BlazeThemes theme. The impact is limited to these particular installations and does not provide full arbitrary plugin deployment or direct code execution.

WordPress sites running Blaze Demo Importer version 1.0.12 or earlier are affected. The vulnerability can only be exploited if the News Kit Elementor Addons plugin and a BlazeThemes theme are already installed and activated on the same site, as these are required components of the exploit path.

The overall severity is medium with a CVSS score of 4.3 and an EPSS score below 1%, indicating a low likelihood of real‑world exploitation at present. The vulnerability is not listed in the CISA KEV catalog. While the attack vector requires user authentication at the Subscriber level or higher, the limited scope of exploitable plugins reduces the potential breadth of impact, yet still poses a tangible risk for sites that have the required components installed.